Subject: [mobile-ip] DHAAD and SA

From: [email-masked]
Date: Fri, 27 Sep 2002 09:59:12 +0530

hi all,
   consider a scenario.  MN's HAis down. MN issues a DHAAD request. some
other HA in responds back...
for further secure communication, there should be an association between MN
and that HA...
does that imply that MN needs to have SA with all HAs in its home subnet???

regards
  gaurav

---

From: Jari Arkko <[email-masked]>
Date: Fri, 27 Sep 2002 10:03:35 +0300

> does that imply that MN needs to have SA with all HAs in its home subnet???

DHAAD doesn't have security requirements within the current specification.
Prefix discovery does, however, as does binding updates of course.

In order to find the home agents, we don't need security assocations.
But to use the home agents, we do. If manual keying is used, this implies
that we indeed need SAs with all home agents! If dynamic keying is used,
then the security associations can be created on demand. At the home
agent side, however, there needs to be information about all mobile nodes
on every home agent -- otherwise the policy of which cert/shared secret
is allowed to use which home address isn't available. But the mobile node
doesn't need to be configured with all the home agent addresses and
security associations.

(However, there's an interesting interaction between DHAAD, prefix discovery,
and IPsec policies. I'll post a note about that soon to the list.)

Jari